topic Re: Remove Text after Numbers in Field in Splunk Search

Remove Text after Numbers in Field

chrisschum — Wed, 21 Aug 2019 17:48:34 GMT

How can I remove everything after the zeroes in a field with results like this '000000000'

Thanks!

Re: Remove Text after Numbers in Field

chrisschum — Wed, 21 Aug 2019 17:54:17 GMT

It took off the full result field because it has a less than and greater than sign

000000000([less than sign]/ParticipantObjectQuery[greater than sign][less than sign]/ParticipantObjectIdentification[greater than sign][less than sign]/AuditMessage[greater than sign]"

Re: Remove Text after Numbers in Field

somesoni2 — Wed, 21 Aug 2019 18:11:10 GMT

I believe you need to provide better example of values, as I don't see anything after the zeros (which portion you want to remove). If your data values are like 0000ABCand you want to change the value to 0000, then you'd do like this (in search)

..| eval fieldnamehere=replace(fieldnamehere,"^(0+)(.+)", "\1")

..| rex field=fieldnamehere mode=sed "s/^(0+)(.+)/\1/"

Re: Remove Text after Numbers in Field

Sukisen1981 — Wed, 21 Aug 2019 18:41:41 GMT

try this

| makeresults
| eval Description="000000000</ParticipantObjectQuery></ParticipantObjectIdentificat></AuditMessage[greater than sign>"

| rex field=Description "(?<Description>\d+)"

Re: Remove Text after Numbers in Field

Sukisen1981 — Wed, 21 Aug 2019 20:57:06 GMT

hi @chrisschum
tried the above?

Re: Remove Text after Numbers in Field

woodcock — Sun, 01 Sep 2019 22:07:52 GMT

Like this:

|  makeresults 
|  eval yourField = "00000000abcde"
|  rex field=yourField mode=sed "s/^(\d+).*$/\1/"